The approaches described in this section could be pursued but are not necessarily approaches that have previously been conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.
An SSL is a cryptographic protocol designed for providing communication security over the Internet. The SSL uses asymmetric cryptography for authenticating a counterparty with which the SSL is communicating, symmetric encryption for confidentiality, and message authentication codes for message integrity. The SSL is widely used for instant messaging and Voice over Internet Protocol, and in applications such as browsing, e-mail, Internet faxing, and others.
Firewall, Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) security appliances usually can only inspect plain text traffic or clear text traffic and have difficulties inspecting the SSL traffic because data packets of the SSL traffic are encrypted. Thus, traditional Packet Capture forensic tools may not be effective when inspecting SSL traffic. Without the ability to inspect SSL traffic, confidential information may be compromised and content can be infected with the help of malware and botnets. Some security appliances have internal SSL decryption/encryption support to inspect incoming and outgoing traffic for security threats. However, such appliances normally use one device for both incoming and outgoing data traffic. This takes its toll on the performance of the device as decryption and encryption of the SSL traffic requires complicated and time- and resource-consuming computations. Therefore, inspection of the SSL traffic for malware, extracted data, or hidden threats by such device may be unsatisfactory.